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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 
to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
efficiency, and effectiveness within the department. 

This report addresses DHS' efforts to develop incident management plans associated with 
the 15 National Planning Scenarios. It is based on interviews with employees and 
officials of relevant agencies and institutions, direct observations, and a review of 
applicable documents. 

The recommendations herein have been developed to the best knowledge available to our 
office, and have been discussed in draft with those responsible for implementation. We 
trust this report will result in more effective, efficient, and economical operations. We 
express our appreciation to all of those who contributed to the preparation of this report. 




Richard L. Skinner 
Inspector General 
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Executive Summary 

The Department of Homeland Security is making progress 
preparing federal incident management plans associated with the 
National Planning Scenarios, but a full set of plans has not yet 
been completed for any of the scenarios. This is partly because of 
the time required to develop and implement the Integrated 
Planning System that guides the federal planning process. 

A strategic guidance statement, strategic plan, and concept of 
operations plan are to be developed for each of the eight key 
scenario sets. Thereafter, operations plans from every department 
and agency with responsibilities enumerated in the concept of 
operations plan are due to the Domestic Readiness Group 120 days 
after the approval of the concept of operations plan. Thus far, five 
of the eight key scenario sets have approved strategic guidance 
statements, while four have approved strategic plans. One concept 
of operations plan, the Terrorist Use of Explosives, has been 
approved by the DHS Secretary and operations plans for this 
scenario were due to the Domestic Readiness Group by September 
2009. A repository for federal incident management plans has 
been established using the Homeland Security Information 
Network, but access is currently limited to only federal officials. 

key scenario sets and 
established planning timelines, we project plans for all the 
scenarios could be completed by . However, we 

note that the concept of operations plans for the 

scenario is . Additionally, strategic 

guidance statement planning for the Natural Disaster, Cyber 
Attack, and Pandemic Influenza scenario sets has not yet begun. 
Enlisting federal departments and agencies that have Emergency 
Support Function coordinating roles within the National Response 
Framework to lead planning efforts for specific scenarios 
concurrently could accelerate the completion of plans. 
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Background 



The National Response Framework describes planning as the 
cornerstone of national preparedness and a critical element to 
respond to a disaster or emergency. Planning provides three 
principal benefits: (1) it allows jurisdictions to influence the 
course of events in an emergency by determining in advance the 
actions, policies, and processes that will be followed, (2) it guides 
other preparedness activities, and (3) it contributes to unity of 
effort by providing a common blueprint for activity in the event of 
an emergency. Planning is a foundational element of both 
preparedness and response and thus is an essential homeland 
security activity. 

The importance of incident management planning was realized 
during the examination of the failed federal response to Hurricane 
Katrina and was underscored in the subsequent White House 
report. 2 The report concluded, "Insufficient planning, training, and 
interagency coordination are not problems that began and ended 
with Hurricane Katrina. The storm demonstrated the need for 
greater integration and synchronization of preparedness efforts, not 
only throughout the Federal government, but also with the State and 
local governments and the private and non-profit sectors as well." 

The White House report recommended that the "Department of 
Homeland Security (DHS) lead an interagency effort to develop 
and resource a deliberative, integrated federal planning and 
execution system to meet the requirements of the revised National 
Response Plan." It also put in motion a number of government 
actions meant to improve response planning, including the 
advancement of credible planning scenarios depicting the range of 
potential terrorist attacks, natural disasters, and related impacts 
facing our Nation. 

Congress enacted the Post-Katrina Emergency Management 
Reform Act of 2006 to address shortcomings identified in the 
preparation for and response to Hurricane Katrina. 3 The 
legislation enhanced the Federal Emergency Management 
Agency's (FEMA) authority and stature within DHS and charged it 



1 The National Response Framework replaced the National Response Plan in January 2008 as the guide to 
how the Nation conducts all-hazards response. It recognizes key lessons learned from Hurricane Katrina 
and focuses on how the federal government is organized to support communities and states in response to 
catastrophic incidents. 

2 The White House, The Federal Response to Hurricane Katrina: Lessons Learned, February 2006 

3 Post-Katrina Emergency Management Reform Act of 2006 (Public Law 109-295), October 4, 2006 
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with leading the Nation's efforts to prepare for, protect against, 
respond to, recover from, and mitigate the risk of natural disasters, 
acts of terrorism, and other manmade disasters, including 
catastrophic incidents. 4 It also provided that the FEMA 
Administrator may develop, in coordination with the heads of 
appropriate federal agencies and the FEMA National Advisory 
Council, planning scenarios that reflect the relative risk 
requirements presented by all hazards. 

DHS released the National Preparedness Guidelines in September 
2007, as part of the effort to further advance Homeland Security 
Presidential Directive-8. 5 The National Preparedness Guidelines 
define what it means for the Nation to be prepared for all hazards. 
One of the four critical elements of the National Preparedness 
Guidelines involves National Planning Scenarios, which depict a 
diverse set of high-consequence threat scenarios of both potential 
terrorist attacks and natural disasters. (See appendix C for an 
overview of the National Planning Scenarios.) 

The 15 National Planning Scenarios were developed by the 
Homeland Security Council, in partnership with DHS, other 
federal departments and agencies, and state, local, tribal, and 
territorial governments. The Homeland Security Council was 
established by Homeland Security Presidential Directive-1 to 
coordinate all homeland security-related activities and policies 
among executive departments and agencies. 

Collectively, the scenarios are designed to focus contingency 
planning for homeland security preparedness work at all levels of 
government and with the private sector. The scenarios form the 
basis for coordinated federal planning, training, exercises, and 
grant investments needed to prepare for all types of emergencies. 
The Homeland Security Council compressed the 15 National 
Planning Scenarios into 8 key scenario sets in October 2007 to 
integrate planning for like events and to conduct cross-cutting 
capability development. Figure 1 lists the 15 National Planning 
Scenarios as they are presented in the National Preparedness 
Guidelines. 



4 FEMA was an independent, Cabinet-level agency reporting directly to the President prior to becoming 
part of DHS in March 2003. The Post-Katrina Emergency Management Reform Act enhanced FEMA's 
authority by designating the FEMA Administrator as the principal emergency management advisor to the 
President and making FEMA a distinct agency within DHS. 

5 Homeland Security Presidential Directive-8 was issued in December 2003 and directed the DHS 
Secretary to develop a national domestic all-hazards preparedness goal. 
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Figure 1. National Planning Scenarios 
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President Bush approved Annex 1 to Homeland Security 
Presidential Directive-8 in December 2007, which formally 
established a standard and comprehensive approach to national 
planning. It directed the DHS Secretary to lead the effort to 
develop, in coordination with the heads of federal agencies with a 
role in homeland security, an Integrated Planning System followed 
by a series of related planning documents for each national 
planning scenario. It also established the timelines for developing 
the family of plans beginning with the strategic plan. Figure 2 
describes the family of incident management plans mandated by 
Annex 1 to Homeland Security Presidential Directive-8, how they 
relate to one another, and the timelines for developing each plan 
after the strategic guidance statement is finalized. 



6 In July 2008, the Improvised Explosive Device scenario was renamed the Terrorist Use of Explosives 
scenario in order to align with Homeland Security Presidential Directive-19. Hereafter, the scenario will 
be referred to as the Terrorist Use of Explosives scenario. 
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Figure 2. Family of Federal Incident Management Plans 
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Plan 



Source: DHS Office of Operations Coordination and Planning PowerPoint Presentation and Annex 1 to 
Homeland Security Presidential Directive— 8 
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Results of Audit 



Status of Federal Incident Management Planning 

The development of federal incident management plans that address the 
gravest dangers facing our Nation is progressing, but a full set of plans for 
any single scenario has yet to be completed partly because of the time 
required to develop and implement the Integrated Planning System. A 
complete set of plans for each planning scenario includes (1) a strategic 
guidance statement, (2) a strategic plan, (3) a concept of operations plan, 
and (4) operations plans from every department and agency with 
responsibilities enumerated in the concept of operations plan. DHS is 
addressing the scenarios based on planning priorities set by the Homeland 
Security Council Deputies Committee and the Domestic Readiness Group, 
interagency policy groups chaired by White House staff. 7 

Strategic and Concept of Operations Plans 

Five of the eight key scenario sets have approved strategic 
guidance statements and four have approved strategic plans. The 
concept of operations plan for the Terrorist Use of Explosives 
scenario was approved by the DHS Secretary in May 2009. 
Operations plans from federal departments and agencies with 
responsibilities enumerated in this plan were due to the Domestic 
Readiness Group by September 26, 2009. The concept of 
operations plan for the scenario is 

and was expected to be completed in . The strategic 

plan for the scenario is also , and DHS 

reports the has been due to the 

review currently underway regarding Homeland Security 
Presidential Directive-8. Concept of operations plans for the 
Biological and Radiological Attack scenarios are both expected to 
be completed in , based on the timelines established 

by the Integrated Planning System. 

Strategic plans are to be completed 90 days after the strategic 
guidance statements, and concept of operations plans are to be 
completed 180 days after the strategic plans. Figure 3 shows the 
status of strategic guidance statements, strategic plans, and concept 
of operations plans for each of the eight key scenario sets. 



7 The Homeland Security Council Deputies Committee serves as the senior sub-Cabinet interagency forum 
for policy issues affecting homeland security. The Domestic Readiness Group convenes regularly to 
develop and coordinate domestic preparedness, response, and incident management policy. 
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Figure 3. Status of Strategic and Concept of Operations Plans (As of 
November 2009) 
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8 The concept of operations plan for the Nuclear Attack scenario set is expected 1 80 days after the strategic 
plan, which was approved on January 8, 2009. FEMA began working on the concept of operations plan for 
this scenario in prior to the approval of the strategic plan. 

9 In response to our draft report, DHS' Office of Operations Coordination and Planning provided evidence 
that the strategic guidance statement for the Chemical Attack scenario set was completed on June 26, 2009, 
following the end of our fieldwork. 

10 The Domestic Readiness Group directed FEMA in 2008 to begin developing a concept of operations plan 
for the Major Hurricane scenario, prior to the approval of the strategic plan, to prepare for the 2009 
hurricane season. 
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Operations Plans 



Operations plans from every department and agency with 
responsibilities enumerated in a concept of operations plan are due 
to the Domestic Readiness Group 120 days after the concept of 
operations plan is approved by the DHS Secretary. Federal 
departments and agencies can address one or more scenario sets 
with a general operations plan when their roles and responsibilities 
are the same. Operations plans are vital because they identify 
detailed resources, personnel, assets and specific roles, 
responsibilities, and actions for each federal department and 
agency responding to an incident or emergency. DHS Secretary 
Napolitano approved the Terrorist Use of Explosives concept of 
operations plan on May 29, 2009. Operations plans from 
federal departments and agencies were due to the Domestic 
Readiness Group in September 2009. (See appendix D for a list of 
departments and agencies that are required to have operations 
plans for the Terrorist Use of Explosives scenario.) 

The departments and agencies responsible for developing 
operations plans for the remaining scenarios are formally identified 
when the concept of operations plans are finalized. It is important 
to note that federal departments and agencies may already have 
operations plans for certain scenarios. 11 The Integrated Planning 
System does not require that existing operations plans be redrafted. 
Rather, departments and agencies with existing operations plans 
must ensure that the plans are compatible with the strategic and 
concept of operations plans developed using the Integrated 
Planning System. 

Performance measures that include quantifiable indicators, 
statistics, or metrics to gauge department or agency effectiveness 
may be required for operations plans. For example, performance 
and effectiveness measures are a stated requirement in the 
Biological Attack scenario strategic plan. This requirement will 
likely mean that departments and agencies will have to review and 
modify operations plans developed prior to the implementation of 
the Integrated Planning System. 

DHS officials told us that no one within DHS has been assigned 
the responsibility for monitoring the development of federal 



11 Prior to the implementation of the Integrated Planning System in June 2008 and between September 2006 
and December 2007, the federal interagency community developed incident response plans for the 
Improvised Nuclear Device, Terrorist Use of Explosives, Pandemic Influenza, Radiological Dispersal 
Device, Major Hurricane, and Cyber Attack scenarios. 
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operations plans. However, ensuring that operations plans contain 
performance measures and fulfill the requirements outlined in the 
Integrated Planning System is important for evaluating current 
response capabilities. Monitoring the development of operations 
plans and providing guidance to facilitate interagency compliance 
with the Integrated Planning System, in addition to the 
incorporation of performance and effectiveness measures in the 
operations plans, would help ensure the plans address and measure 
desired objectives and priority capabilities for each scenario. 

Launching the Integrated Planning System 

The time required developing and implementing the Integrated 
Planning System, which guides the federal planning process, 
impacted the initiation of planning for the National Planning 
Scenarios. DHS officials told us that the planning resources 
required to address the Period of Heightened Alert 12 and the 
Southwest Border Initiative also impacted planning for the 
National Planning Scenarios. 

The Integrated Planning System was expected to be finalized in 
February 2008, but President Bush did not formally approve the 
system until nearly a year later in January 2009. DHS began 
developing the Integrated Planning System in December 2007 and 
implemented an interim version in June 2008. DHS officials told 
us that bringing the federal departments and agencies together to 
develop and agree upon a standardized planning process and 
doctrine was a significant challenge and achievement. 

The Period of Heightened Alert and the Southwest Border 
Initiative also impacted planning for the National Planning 
Scenarios because planning resources had to be redirected to meet 
the planning requisites for these initiatives. Planning for the 
Period of Heightened Alert began in early 2008, and the Homeland 
Security Council directed the federal interagency community to 
have significant planning completed by early July 2008. Plans 
were designed to ensure that the federal government was prepared 
to respond to any major incident during the Presidential transition 
period. Planning that supported the Southwest Border Initiative 
was designed to suppress the illegal flow of weapons and cash 
from the United States into Mexico and drugs and contraband from 



DHS designated the time period between August 1, 2008, and July 31, 2009, as a "Period of Heightened 
Alert" because of activities associated with the 2008 Presidential election, such as the national conventions, 
Election Day, the Presidential inauguration, and the Presidential transition period. 
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Mexico into the United States by placing more personnel and 
technology assets on the southwest border. 

Conclusion 

Federal incident management planning for the National Planning 
Scenarios is progressing, but much work remains to be done. The 
concept of operations plan for the 

scenario is and was expected to be completed in 

. The concept of operations plan for the Biological Attack 
scenario is due in . Moreover, planning for the 

concept of operations plan for the Radiological Attack scenario 
, but the plan is due in . Operations 

plans from federal departments and agencies for the first scenario, 
the Terrorist Use of Explosives, were due to the Domestic 
Readiness Group by September 26, 2009. The requirement to 
include performance and effectiveness measures in the Biological 
Attack scenario operations plans may require departments and 
agencies to modify existing plans. Providing guidance on how to 
incorporate quantifiable performance and effectiveness measures 
into operations plans would help ensure that the plans contain 
desired objectives and identify priority capabilities. 



Recommendation 

We recommend that the Director for Operations Coordination and 
Planning: 

Recommendation #1 ; Oversee the development of operations 
plans and collaborate with FEMA's Operational Planning Branch 
to provide guidance to federal departments and agencies to 
facilitate the incorporation of performance and effectiveness 
measures into operations plans. 

Management Comments and OIG Analysis 

Recommendation 1 : FEMA's Office of Policy and Program 
Analysis concurred with this recommendation. DHS' Office for 
Operations Coordination and Planning explained in their response 
to our draft report that the Integrated Planning System is currently 
under review and the requirement to incorporate performance and 
effectiveness measures into operations plans will be addressed 
during the review process. 
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We consider this recommendation resolved because steps are being 
taken to implement it; however, it will remain open until evidence 
is provided that it has been fully implemented. 

Projecting the Completion of Plans 

We project that plans for all scenarios could be completed by 

key scenario sets and 
established planning timelines outlined in Annex 1 to Homeland Security 
Presidential Directive-8. DHS' Office of Operations Coordination and 
Planning is leading the development of strategic guidance statements and 
strategic plans, and FEMA's Operational Planning Branch is leading the 
development of concept of operations plans. According to the National 
Response Framework, planning for the National Planning Scenarios has 
been accorded the highest priority. Enlisting federal departments and 
agencies that have Emergency Support Function coordinating roles in the 
National Response Framework to lead planning efforts for specific 
scenarios concurrently could accelerate the completion of plans for the 
remaining scenarios. 

Timelines for Developing Plans 

Annex 1 to Homeland Security Presidential Directive-8 establishes 
the timelines for developing the family of plans beginning with the 
strategic plan. Completing the family of plans is expected to take 
390 days following the completion of the strategic guidance 
statement. DHS officials told us that DHS Secretary Chertoff 
decided that DHS' Office of Operations Coordination and Planning 
would lead the development of strategic guidance statements and 
strategic plans, and FEMA's Operational Planning Branch would 
lead the development of concept of operations plans. 

Projections 

The average number of days between initiating strategic guidance 
statement planning for the first four National Planning Scenario 
sets was 78 days. Figure 4 illustrates the average number of days 
between initiating planning for the first four key scenario sets. The 
average time to complete the strategic guidance statements was 95 
days. Figure 5 illustrates how long it took to complete each 
strategic guidance statement for the first four key scenario sets. 
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Figure 4. Average Number of Days Between Plan Initiation for 
Strategic Guidance Statements 
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. Figure 6 illustrates our projections 
for completing all plans, which will serve as our baseline for 
monitoring DHS' progress towards completing federal incident 
management plans for the 15 National Planning Scenarios. 



DHS' Progress in Federal Incident Management Planning 
Page 12 



Figure 6. Projected Completion Dates (As of November 2009) 
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The Interagency Planning Teams 

DHS' Office of Operations Coordination and Planning relies upon 
participation from the Incident Management Planning Team and 
interagency subject matter experts to develop the strategic 
guidance statement and strategic plans for each key scenario set. 
The Incident Management Planning Team is composed of a core 
group of full-time senior planners (i.e., GS-14/15 with at least a 
Top Secret clearance) who are detailed to DHS from other federal 
departments and agencies for 1-year assignments. An on-call 
group of pre-identified senior planners from DHS and other 
departments and agencies can augment the core staff when 
necessary. (See appendix E for a list of departments and agencies 
that are participating members of the Incident Management 
Planning Team.) 
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FEMA's Operational Planning Branch also relies upon 
participation from a federal interagency planning team, but 
representatives who support FEMA planning efforts are not 
detailed to FEMA. FEMA develops the concept of operations 
plans for each scenario set through planning conferences that 
include interagency representatives and contractors who facilitate 
the planning process or provide subject matter expertise. 

The Domestic Readiness Group set a planning goal that five 
strategic guidance statements and four strategic plans be completed 
by January 20, 2009. DHS and interagency officials told us the 
demands placed on the planning teams to reach this goal were 
tremendous. Planners were required to work on multiple plans at 
the same time, and they often had to choose between incident 
management planning meetings that were scheduled concurrently. 
DHS officials told us that efforts are ongoing to address the 
shortage of federal planners, and more than 1,000 people from 
multiple departments and agencies have been successfully trained 
on national planning by the Incident Management Planning Team 
since 2006. 

Accelerating the Completion of Scenario Plans 

The National Response Framework underscores that planning for 
the National Planning Scenarios has been accorded the highest 
priority. It also describes Emergency Support Function 
coordinating agencies as having ongoing responsibilities 
throughout the preparedness, response, and recovery phases of 
incident management to include pre-incident planning and 
coordination. Enlisting federal departments and agencies that have 
Emergency Support Function coordinating roles to lead planning 
for the National Planning Scenarios could accelerate the 
completion of plans for the remaining scenarios because planning 
could be conducted concurrently. Figure 7 lists the remaining 
planning scenarios along with the Emergency Support Function 
coordinating agency for that scenario. 
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Figure 7. Coordinating Agencies 
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DHS is the coordinating department for all deliberate attacks 
involving nuclear or radiological facilities or materials, including 
improvised nuclear devices and radiological dispersal devices. 
DHS, acting through FEMA, is also the coordinating department 
for response to natural disasters. 

The Environmental Protection Agency is the Emergency Support 
Function coordinating agency for oil and hazardous materials 
response, which includes accidentally or intentionally released 
chemical substances. As such, this agency is well positioned to 
lead planning efforts associated with the remaining Chemical 
Attack scenario plans. 

A recent White House review of cyberspace policy determined that 
no single federal department or agency has a broad enough 
perspective or authority to address the cybersecurity risks, which 
pose some of the most serious economic and national security 
challenges of the 21st century. 13 The review recommended that 
the President appoint a White House cybersecurity policy official 
to coordinate national cybersecurity policies and activities. The 
goal is to develop a clear and authoritative cyber incident response 
framework documented in a revised Cyber Incident Annex for the 
National Response Framework. 

The Department of Health and Human Services is the federal 
government's primary agency for the public health and medical 



13 The White House, Cyberspace Policy Review: Assuring a Trusted and Resilient Information and 
Communications Infrastructure, May 2009 
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preparation, planning, and response to a biological terrorism attack 
or incident. It has already taken steps to coordinate national 
planning for the Pandemic Influenza scenario by leading two 
interagency assessments of states' Pandemic Influenza plans. 
Because of its role as the primary agency for planning and 
responding to biological scenarios and its previous efforts to 
coordinate national planning, the Department of Health and 
Human Services could lead the development of federal incident 
management plans for the Pandemic Influenza scenario. 

Conclusion 

We project that planning for all the scenarios could be completed 
by key 
scenario sets and established planning timelines. However, we 
note that DHS has not begun strategic guidance statement planning 
for the Natural Disaster and Cyber Attack scenario sets, which we 
projected should have been initiated months ago. The National 
Response Framework characterizes planning for the National 
Planning Scenarios as a high priority. Enlisting the Environmental 
Protection Agency, the White House, and the Department of 
Health and Human Services to lead planning efforts concurrently 
for the remaining scenarios could accelerate the completion of 
plans for the Chemical Attack, Cyber Attack, and Pandemic 
Influenza scenarios. 



Recommendation 

We recommend that the Director for Operations Coordination and 
Planning and the Chief of FEMA's Operational Planning Branch: 

Recommendation #2 : Enlist and resource, as appropriate, federal 
departments and agencies that have coordinating roles for the 
Chemical Attack, Cyber Attack, and Pandemic Influenza scenarios, 
in order to pursue planning efforts for each scenario concurrently. 



Management Comments and OIG Analysis 

Recommendation 2 : FEMA's Office of Policy and Program 
Analysis concurred with this recommendation. DHS' Office for 
Operations Coordination and Planning explained in their response 
that a discussion on further increasing the roles and the planning 
capabilities of their interagency partners is an integral component 
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of the Quadrennial Homeland Security Review and the review of 
Homeland Security Presidential Directive-8. Additionally, 
planning has been put on hold since July 2009 due to the review of 
Homeland Security Presidential Directive-8, delaying the 
development of the Chemical Attack strategic plan and the Natural 
Disaster strategic guidance statement. 

We consider this recommendation resolved because steps are being 
taken to implement it; however, it will remain open until evidence 
is provided that it has been fully implemented. 



The Federal Incident Management Plan Repository 

A repository for federal incident management plans was established in 
March 2009 using the Homeland Security Information Network. The 
purpose of the repository is to increase federal visibility, coordination, 
interoperability, and information sharing at the operational level. All 
unclassified federal plans relating to the National Planning Scenarios are 
to be placed in the repository, and classified plans will be maintained 
separately in the Homeland Security Data Network. Access to the 
repository is currently limited to federal officials with a role in homeland 
security. 

Establishing the Repository 

A DHS Office of Operations Coordination and Planning official 
told us that the Domestic Readiness Group tasked their office in 
February 2009 with establishing a repository for federal incident 
management plans. The Homeland Security Information Network 
was chosen as the platform to establish the repository in March 
2009. The Homeland Security Information Network is a virtual 
platform that enables sensitive but unclassified information sharing 
and collaboration among homeland security stakeholders, 
including federal, state, and local government representatives. The 
repository is expected to help address a key finding in the White 
House report about the federal response to Hurricane Katrina: "At 
the most fundamental level, part of the explanation for why the 
response to Katrina did not go as planned is that key decision- 
makers at all levels simply were not familiar with the plans." 

The purpose of the repository is to enhance the effectiveness of 
operations to prevent, protect against, respond to, and recover from 
attacks and disasters. The overall goal is to achieve a coordinated 
approach to planning for major emergencies, disasters, and 
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catastrophes, and to identify response capabilities and conduct 
exercises. When fully populated, the repository is anticipated to 
contain more than 250 federal incident management plans relating 
to the 15 National Planning Scenarios. 

The repository will include all unclassified federal strategic and 
concept of operations plans associated with the National Planning 
Scenarios, as well as operations plans from federal departments 
and agencies that have a role in homeland security. The decision 
as to whether operations plans are added to the Homeland Security 
Information Network is at the discretion of the department or 
agency that prepared the plan. Classified plans are to be 
maintained separately on the Homeland Security Data Network. 
The Homeland Security Data Network is a classified wide-area 
network for DHS and its components, with specific and controlled 
interconnections to federal agencies that are involved in homeland 
security. 

According to the repository's standard operating procedures, 
operations plans are reviewed by the interagency to identify best 
practices, seams, gaps, and overlaps. Issues involving discrepancies 
or shortfalls in operations plans will be resolved by a work group 
established by the Domestic Readiness Group and chaired by a 
National Security Council staff member. The Integrated Planning 
System provides that the DHS Secretary will also review operations 
plans to identify gaps and seams, enhance unity of effort, and link 
plans to exercises. This is important because the DHS Secretary 
serves as the principal federal official for domestic incident 
management and is responsible for coordinating the federal 
government's resources in operations responding to terrorist attacks 
and major disasters. 

Access and Participation 

Access to the repository is currently limited to select federal 
officials and controlled by the Domestic Readiness Group. Federal 
departments and agencies involved in federal incident management 
planning may designate up to five individuals for access to the 
repository, and access will be provided by DHS once approved by 
the Domestic Readiness Group. Currently, state, tribal, and local 
government officials do not have access or provide plans to the 
repository although they may have access to other areas of the 
Homeland Security Information Network. Expanding access and 
stakeholder participation in the repository is important because a 
key lesson learned from the federal response to Hurricane Katrina 
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is that integrating and synchronizing federal policies, strategies, 
and plans among all federal, state, local, private sector, and 
community efforts is imperative for a coordinated response. 

Conclusion 

A repository for federal incident management plans has been 
established using the Homeland Security Information Network, but 
access is currently limited to only federal officials. The repository 
can serve as the platform to help construct a unified homeland 
security system that advances national preparedness, but 
appropriate access and participation among all homeland security 
stakeholders, including state, tribal, and local government officials, 
and the private sector, needs to be expanded. 



Recommendation 

We recommend that the Director for Operations Coordination and 
Planning: 

Recommendation #3 : Develop procedures and protocols for 
expanding access to the federal incident management plan 
repository to all appropriate homeland security stakeholders, 
including state, tribal, and local governments, and the private sector. 



Management Comments and OIG Analysis 

Recommendation 3 : FEMA's Office of Policy and Program 
Analysis concurred with this recommendation, and DHS' Office 
for Operations Coordination and Planning is currently in the 
process of increasing membership to the federal incident 
management plan repository to include all appropriate homeland 
security stakeholders. 

We consider this recommendation resolved because initial steps 
are being taken to implement it. However, it will remain open 
until evidence is provided that it has been fully implemented. 
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Appendix A 

Purpose, Scope, and Methodology 



The objectives of our audit were to (1) determine to what extent 
the planning requisites mandated by Annex 1 to Homeland Security 
Presidential Directive-8 have been fulfilled, and (2) develop a 
baseline to measure progress in developing the federal incident 
management plans that align with the National Planning Scenarios. 

We conducted 18 interviews with DHS, FEMA, and interagency 
officials, and examined documentation relating to federal planning, 
including authorizing legislation and Presidential directives such as 
the Integrated Planning System; federal incident management 
plans; internal and external DHS communications; the Post- 
Katrina Emergency Management Reform Act of 2006; the National 
Response Framework and Incident Annexes; Annex 1 of Homeland 
Security Presidential Directive-8; and Homeland Security 
Planning Directive-5. We also reviewed reports on various 
aspects of federal planning for the national planning scenarios 
prepared by the U.S. Government Accountability Office. 

We did not evaluate the utility of the finalized federal incident 
management plans or the efficacy of the Homeland Security 
Information Network and the Homeland Security Data Network. 
We were also unable to verify the start dates provided to us by 
DHS for all of the strategic guidance statements and the strategic 
plans relating to the Radiological Attack and Biological Attack 
scenarios. 

We acknowledge the cooperation and courtesies extended to our 
audit team during this audit. We conducted this performance audit 
between October 2008 and May 2009 - we also updated 
information contained in the report as of November 2009 - under 
the authority of the Inspector General Act of 1978, as amended, 
and in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the 
audit to obtain sufficient, appropriate evidence to provide a 
reasonable basis for our findings and conclusions based on our 
audit objectives. We believe that the evidence obtained provides a 
reasonable basis for our findings and conclusions based on our 
audit objectives. 
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Appendix B 

Management Comments to the Draft Report 



U.S. Department of Homeland Security 

500 C Street, SW 
Washington, DC 20472 




FEMA 



MEMORANDUM FOR: Matt Jadacki 

Deputy Inspector General 

Office of Emergency Management Oversight 

Office of Inspector General 



FROM: David J. Kaufman r 

Director V** 00 ^ ^ 

Office of Policy and Program Analysis 

SUBJECT: Federal Emergency Management Agency's (FEMA's) 

Response to Office of Inspector General (OIG) Report on 
DHS Progress in Federal Incident Management Planning 

FEMA has reviewed the subject report. We concur with the recommendations and have 
no further comments. 

Please contact Brad Shefka, Chief, FEMA GAO/OIG Liaison, at 202-646-1308 if you 
have any questions or concerns. 



www.fema.gov 
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Appendix B 

Management Comments to the Draft Report 




Office of Operations Coordination 
and Planning 

U.S. Department of Homeland Security 

Washington, DC 20528 



NOV 6 2009 



Homeland 
Security 



MEMORANDUM FOR: 



Matt Jadacki 



FROM: 




SUBJECT: 



Inspector General Report on "DHS' Progress in Federal Incident 
Management Planning" Response 



BACKGROUND: 

The Office of Operations Coordination and Planning (OPS) Plans Division appreciates the 
opportunity to comment on the draft DTIS Office of Inspector General (OIG) Report on "DHS' 
Progress in Federal Incident Management Planning." 

The mission of OPS is to integrate departmental- and strategic-level interagency planning and 
operations coordination in order to prevent, protect, respond to, and recover from terrorist 
threats/attacks or natural disasters. OPS, facilitates the development of Federal strategic plans 
and operations plans in accordance with the process described in the Integrated Planning System. 

OPS, in collaboration with the Domestic Readiness Group, has endorsed the Incident 
Management Planning Team (IMPT) since August 21, 2006. The IMPT provides a unified 
interagency planning effort for incidents requiring a coordinated national response. The IMPT 
also supports the development of strategic guidance, concepts, plans, and plan refinement 
leading to publication of a series of plans for actual or potential domestic incidents. 

In order to fully represent the entirety of its planning efforts, OPS would like to provide the 
following comments on the OIG draft report. 



UNCLASS1FIED//TO***- 



ww.dhs.gov 
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Appendix B 

Management Comments to the Draft Report 

DISCUSSION: 



OIG Recommendation UL Oversee the development of interagency operations plans and 
collaborate with FEMA f s Operational Planning Branch and provide guidance to federal 
department and agencies to facilitate the incorporation of performance and effectiveness 
measures into operational plans. 



The Integrated Planning System (IPS) is currently under a review process that will address the 
need to require operations plans to incorporate performance and effectiveness measures. At this 
time, the IPS does not require operations plans to address performance and effectiveness 
measures. 

Operations plans arc department- and agency-specific and are not interagency plans. There is 
currently no authority or statute that requires Federal departments and agencies to coordinate 
their operations plans with DHS or any other department/agency. 



OIG Recommendation #2. Enlist and resource, as appropriate, federal departments and 
agencies that have coordinating roles for (he Chemical Attack, Cyber Attack and Pandemic 
Influen za scenarios, in ord er to pursue planning efforts for each scenario concurrently. 

Through the Incident Management Planning Team (IMPT), OPS enlists interagency deiailees 
and subject matter experts from Federal departments and agencies with a role in homeland 
security. From the beginning of plan development, our interagency partners within the [MPT are 
invited to participate to ensure their interests are strongly represented. 

However, there are a limited number of planners available in Federal agencies with Emergency 
Support Function coordinating roles for chemical, cyber, and pandemic influenza scenarios. A 
discussion on further increasing the roles and the planning capabilities of our interagency 
partners is an integral component of the Quadrennial Homeland Security Review and the 
Homeland Security Presidential Directive & (HSPD-8) review. 

OIG Recommendation #3. Develop procedures and protocols for expanding access to the 
federal incident management plan repository to all appropriate homeland security stakeholders, 
including state, tribal and local governments and the private sector. 



OPS is currently in the process of increasing membership to the Federal incident 
management plan repository to include all appropriate homeland security stakeholders. 

ADDITIONAL COMMENTS: 

In addition to the above review of the recommendations within this report, OPS notes that some 
documentation be updated, such as times, dates, and authorities. OPS requests that these 
portions of the document be revised and suggests these revi sions may influence one or more 
recommendations. Attached to this memo is a comment matrix for your consideration. 

U HC LA SS t Ki ED/ffOW 
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Management Comments to the Draft Report 

It is also worth noting that planning has been put on hold since July 2009 due to an HSPD-8 
Review by the Domestic Readiness Group and the National Security Council. This has resulted 
in a delay in the development of the Chemical Strategic Plan and the Natural Disaster Strategic 



Enclosures: 

Attachment 1 - A Previous Plan Development Timeline 
Attachment 2 — A Comment Matrix 
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Appendix C 

Overview of the National Planning Scenarios 

Scenario 1: Nuclear Detonation - Improvised Nuclear Device 

• Members of a terrorist organization have detonated a 10-kiloton improvised 
nuclear device in a heavily populated metropolitan area. The initial detonation 
causes total infrastructure damage in a 3 -mile radius and various levels of 
radiation spanning out 3,000 square miles. As casualties climb in excess of 
several hundred thousand, hundreds of thousands of survivors either shelter in 
place or are forced onto the city's transportation system to seek shelter in safe 
areas or evacuate the city. The city is now facing hundreds of billions of dollars 
in damage and a recovery effort that will take years. 

Scenario 2: Biological Attack - Aerosol Anthrax 

• Two individuals release 100 liters of aerosolized anthrax into the air of a major 
metropolitan city. More than 330,000 people are exposed to the anthrax spores. 
Casualties and injuries resulting from the inhaled anthrax and subsequent 
infection reach upwards of 13,000 people. The economic costs associated with 
the closure and decontamination of affected areas may run in the billions of 
dollars, and the city will likely face a recovery effort that will take months. 

Scenario 3: Biological Disease Outbreak - Pandemic Influenza 

• A new strain of avian influenza has spread to the United States. Estimates predict 
that fatalities could range anywhere between 209,000 and 1.9 million people, with 
an even greater number requiring hospitalization. Hospital bills alone could reach 
upwards of $180 billion. 

Scenario 4: Biological Attack - Pneumonic Plague 

• Members of a terrorist organization manufacture the causative agent of plague 
and disseminate it in several metropolitan areas using biological warfare 
dissemination devices. Approximately 36 hours after release, patients begin 
showing up at hospitals with rapidly progressing and severe respiratory illnesses. 
Estimates predict that fatalities could range upwards of 9,500 people with 
approximately 28,383 people becoming ill. As word gets out that pneumonic 
plague is spreading, hospitals will see an influx of people crowding into 
emergency rooms, possibly creating a shortage of available beds. 

Scenario 5: Chemical Attack - Blister Agent 

• Members of a terrorist organization use a lightweight aircraft to spray Agent 
Yellow, which is a mixture of two blister agents that can cause permanent damage 
to the respiratory system if inhaled and severe burns to the eyes or skin, into a 
crowded college football stadium. Thousands are injured and many are killed as 
people flee from the contaminated stadium. Additional injuries and fatalities will 
occur as a result of contact with the blister agent. Tens of thousands of people 
will need decontamination, as well as both short-term and long-term care. 
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Overview of the National Planning Scenarios 

Scenario 6: Chemical Attack - Toxic Industrial Chemicals 

• Sleeper cells of a domestic terrorist organization have launched a multiphase 
attack at a port and a nearby petroleum refinery. Utilizing vehicle-borne 
improvised explosive devices, the terrorists target a U.S. Coast Guard facility and 
two container ships containing hazardous material. The terrorists initiate the 
second phase of the attack by launching rocket-propelled grenades into the center 
of the petroleum refinery. Several hundred people are killed, thousands are 
injured, and thousands more are forced to evacuate or shelter in place as a result 
of the explosions, fires, and vapor plume. Recovery efforts will likely take 
months and the economic impact will likely be in the billions. 

Scenario 7: Chemical Attack - Nerve Agent 

• Members of a terrorist organization have acquired the nerve agent sarin and have 
released it into the ventilation system of a large office building in a metropolitan 
area. The agent quickly kills 95% of the building's 6,000 occupants. Even more 
injuries and deaths occur as first responders arrive on the scene unaware of the 
current conditions. As the nerve agent escapes the building, almost 50,000 people 
located in adjacent buildings are forced to shelter in place. Recovery time will 
likely be 3 to 4 months, with the total economic impact reaching upwards of 
$300 million. 

Scenario 8: Chemical Attack - Chlorine Tank Explosion 

• Members of a terrorist organization have detonated an explosive device on a 
60,000-gallon storage tank filled with liquefied chlorine gas. The terrorists have 
also planted improvised explosive devices, set to detonate at varying intervals, 
close to the tank in order to harm emergency responders. Within an hour, there 
are almost 10,000 people crowding into emergency rooms with severe respiratory 
difficulties. As the gas continues to move downwind, as many as 35,000 people, 
or 5% of those in the affected area, are exposed to potentially lethal doses of 
chlorine gas. Recovery will take several weeks and likely cost millions of dollars. 

Scenario 9: Natural Disaster - Major Earthquake 

• A major metropolitan area, with a population of almost 10 million people, 
experiences a 7.5 magnitude earthquake followed shortly by an 8.0 magnitude 
earthquake. In the area within 25 miles of the fault, many homes and buildings 
are completely destroyed. Approximately 1,400 people are killed, 100,000 more 
are crowding into hospital emergency rooms, and an intense search and rescue for 
an estimated 20,000 people has been launched. Recovery efforts are expected to 
range from several months to several years, and the estimated total economic 
impact is projected to be in the billions. 
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Overview of the National Planning Scenarios 

Scenario 10: Natural Disaster - Major Hurricane 

• A category 5 hurricane, with sustained wind speeds in excess of 160 miles per 
hour and a storm surge 20 feet higher than normal, makes landfall at a major 
metropolitan area. The storm surge, heavy winds, and subsequent tornados 
spawned by the hurricane cause destruction to nearly 200,000 homes and result in 
nearly 1,000 fatalities. With such a wide path of destruction, recovery from the 
hurricane will likely take several months to a couple of years with the total 
economic impact reaching into the billions. 

Scenario 11: Radiological Attack - Radiological Dispersal Devices 

• Members of a terrorist organization have manufactured and detonated a 
radiological dispersal device or a "dirty bomb" in three regionally close, moderate 
to large cities. Each explosion causes significant damage to many of the buildings 
and structures in the immediate area of the blast. At each site, there are 
approximately 180 deaths and upwards of 20,000 detectable contaminations. 
Recovery efforts will likely take several months to a couple of years. Total 
economic loss will be in the billions of dollars. 

Scenario 12: Explosives Attack - Terrorist Use of Explosives 

• Members of a terrorist organization have carried out a multipronged attack using 
improvised explosive devices at a large urban entertainment/sports venue. Three 
suicide bombers detonated their devices, killing and injuring some people and 
sending the rest of the large crowd in a frantic rush to the exits, where they are 
met by the detonation of a large vehicle bomb. Similar detonations also occur 
near a crowded public transportation concourse, a parking lot, and inside the 
lobby of the nearest hospital emergency room. The explosions combine to cause 
millions of dollars in damage and to kill approximately 100 people. Recovery 
efforts will take weeks. 

Scenario 13: Biological Attack - Food Contamination 

• A member of a terrorist organization, who works at a meat processing plant on the 
West Coast, contaminates the meat with anthrax. Two contaminated batches of 
ground beef were sent to two different states. In a 10-day span, hospitals on the 
West Coast begin to see a sudden influx of people with gastrointestinal problems. 
Upwards of 1,800 have become ill and there have been 500 fatalities. Recovery 
efforts to address contamination sites and provide for those who have become ill 
will take millions of dollars and likely last for several weeks. 

Scenario 14: Biological Attack - Foreign Animal Disease 

• Members of a terrorist organization have launched a biological attack on the 
agricultural industry by infecting livestock at various transportation sites with a 
foreign animal disease. Farmers in several states quickly realize that many of 
their animals are ill. As it is realized that a foreign animal disease is spreading, 
recovery efforts will likely take weeks and require hundreds of millions of dollars 
to diagnose, quarantine, destroy, and dispose of livestock herds. 
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Overview of the National Planning Scenarios 

Scenario 15: Cyber Attack 

• Members of a terrorist organization launch a cyber attack against critical 

infrastructures that rely on the Internet. Service disruptions occur across many 
sectors and there is a general fear that there will be a loss of confidence in the 
Internet and the services it provides. Recovery efforts will likely take months and 
cost upwards of several hundred million dollars. 
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Federal Interagency Providing Operations Plans for Scenario 12 




Terrorist Use of Explosives 
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Appendix E 

Incident Management Planning Team 



Core Full-Time Members 


On-Call Members 


• DHS, Chair 

• Department of Defense 

• Department of Justice 

o Federal Bureau of Investigation 

• Department of Health and Human 
Services 

• Department of Transportation 

• Department of Energy 

• Environmental Protection Agency 

• American Red Cross 


• Department of State 

• Department of Treasury 

• Department of Commerce 

• Department of the Interior 

• Department of Agriculture 

• Department of Labor 

• Department of Housing and Urban 
Development 

• Department of Education 

• Department of Veterans Affairs 

• Federal Communications Commission 

• General Services Administration 

• National Aeronautics and Space 
A dmini strati on 

• Nuclear Regulatory Commission 

• Office of the Director of National Intelligence 

• Office of Personnel Management 

• Small Business Administration 

• United States Postal Service 

• White House Office of Science and 
Technology Policy 



Source: Charter for the Incident Management Planning Team, August 21, 2006 
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Appendix F 

Major Contributors to This Report 

Norman Brown, Director, Preparedness and Mitigation Division, 
Office of Emergency Management Oversight 

Soraya Vega, Auditor-in-Charge, Preparedness and Mitigation 
Division, Office of Emergency Management Oversight 

Adrian Dupree, Supervisory Auditor, Preparedness and Mitigation 
Division, Office of Emergency Management Oversight 

Ryan Hartong, Program Analyst, Preparedness and Mitigation 
Division, Office of Emergency Management Oversight 
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Report Distribution 



Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff for Operations 

Chief of Staff for Policy 

Deputy Chiefs of Staff 

General Counsel 

Executive Secretariat 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

FEMA Administrator 

DHS Audit Liaison 

FEMA Audit Liaison (DP9P03) 

Office of Management and Budget 

Chief, Homeland Security Branch 
DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committee, as 
appropriate 
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ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



